Analysis
- max time kernel
76s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe
- Size 208KB
- Sample260720-x4d7naew4x
- SHA256 00916048b35a69fbe836530b054e8c69af9055c8802e057efe8cf3b9bb77a894
- MD5 68782efa24e5cd62db90042edc3af675
- SHA1 a956791ba9a6b4e51f69620280ade7e11473fa10
- SHA512 6fdade5260c71f29168fdda7fa5ce74f40f6d9654f44de1101702bdcb8cfa08efa33c73c90f4a71262de88e3b56185ae7fd1f0b4cfe51094f85eeaffb6489161
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOfT4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LOrkEj1
- TLSH T17C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1680 JPGBE.exe 5436 SNACP.exe 1856 QXDS.exe 2872 SVR.exe 2000 YQIN.exe 4444 BEZWD.exe 2364 FUGW.exe 2940 UKPWOE.exe 1776 YSV.exe 1432 CICWNPB.exe 4740 XVHF.exe 4544 DQGOU.exe 2392 QTO.exe 5864 ARUZXDJ.exe 960 PHVYWY.exe 3892 IKH.exe 5868 SIMPRXI.exe 5020 HDWTC.exe 5404 LGU.exe 1728 XYJZTD.exe 3708 XBNDZ.exe 2428 HZTPOCL.exe 3448 RIVCSH.exe 1704 WICQBB.exe 4824 AQJQN.exe 4460 QGKPUPA.exe 4732 UOZP.exe 4296 NOGA.exe 4340 LCFBUET.exe 4976 QHYQKZ.exe 5224 FXZQ.exe 5376 JNFQVN.exe 5596 SOH.exe 4592 CMNPOSK.exe 1748 NEQ.exe 1768 TEXWFC.exe 2956 XUE.exe 4788 USK.exe 3204 SNBBDZ.exe 3636 QLUW.exe 1796 ILWCU.exe 1548 GWZS.exe 2484 WZJENKN.exe 1456 UMI.exe 3644 YDOFEYQ.exe 5572 AQTO.exe 1420 TTXSUW.exe 4932 TOBOZ.exe 4808 MRNRNBS.exe 3700 BMWWY.exe 3592 CPAZDMC.exe 4844 VSEVRC.exe 2536 OLTG.exe 3140 HOXKGTV.exe 1160 BBCT.exe 1128 WOGCAS.exe 5780 YCL.exe 3760 TXIVN.exe 4588 ANR.exe 5548 WQATHQ.exe 904 ZGG.exe 3016 EJEOUC.exe 5392 RUVF.exe 5056 DCBN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CMAE.exe FLYUG.exe File created C:\windows\SysWOW64\CMAE.exe.bat FLYUG.exe File created C:\windows\SysWOW64\BEZWD.exe YQIN.exe File opened for modification C:\windows\SysWOW64\UMI.exe WZJENKN.exe File created C:\windows\SysWOW64\TTXSUW.exe.bat AQTO.exe File opened for modification C:\windows\SysWOW64\EJEOUC.exe ZGG.exe File created C:\windows\SysWOW64\IDCTCU.exe NSMDOR.exe File created C:\windows\SysWOW64\AFVKJS.exe UEOW.exe File opened for modification C:\windows\SysWOW64\KGS.exe MLT.exe File created C:\windows\SysWOW64\LGU.exe.bat HDWTC.exe File created C:\windows\SysWOW64\UOZP.exe.bat QGKPUPA.exe File created C:\windows\SysWOW64\JNFQVN.exe.bat FXZQ.exe File created C:\windows\SysWOW64\TXIVN.exe.bat YCL.exe File created C:\windows\SysWOW64\KGS.exe MLT.exe File opened for modification C:\windows\SysWOW64\QXDS.exe SNACP.exe File created C:\windows\SysWOW64\YSV.exe UKPWOE.exe File opened for modification C:\windows\SysWOW64\XVHF.exe CICWNPB.exe File created C:\windows\SysWOW64\XVHF.exe.bat CICWNPB.exe File created C:\windows\SysWOW64\QHYQKZ.exe LCFBUET.exe File opened for modification C:\windows\SysWOW64\IDCTCU.exe NSMDOR.exe File opened for modification C:\windows\SysWOW64\UOZP.exe QGKPUPA.exe File created C:\windows\SysWOW64\TTXSUW.exe AQTO.exe File created C:\windows\SysWOW64\JPGBE.exe.bat 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe File created C:\windows\SysWOW64\YSV.exe.bat UKPWOE.exe File created C:\windows\SysWOW64\EJEOUC.exe ZGG.exe File created C:\windows\SysWOW64\AFVKJS.exe.bat UEOW.exe File created C:\windows\SysWOW64\BZM.exe BEJCKTO.exe File opened for modification C:\windows\SysWOW64\JPGBE.exe 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe File created C:\windows\SysWOW64\QXDS.exe.bat SNACP.exe File opened for modification C:\windows\SysWOW64\ARUZXDJ.exe QTO.exe File created C:\windows\SysWOW64\QHYQKZ.exe.bat LCFBUET.exe File opened for modification C:\windows\SysWOW64\VSEVRC.exe CPAZDMC.exe File created C:\windows\SysWOW64\VSEVRC.exe.bat CPAZDMC.exe File opened for modification C:\windows\SysWOW64\BEZWD.exe YQIN.exe File opened for modification C:\windows\SysWOW64\JNFQVN.exe FXZQ.exe File opened for modification C:\windows\SysWOW64\CMAE.exe FLYUG.exe File created C:\windows\SysWOW64\KGS.exe.bat MLT.exe File created C:\windows\SysWOW64\QXDS.exe SNACP.exe File created C:\windows\SysWOW64\ARUZXDJ.exe QTO.exe File created C:\windows\SysWOW64\JNFQVN.exe FXZQ.exe File opened for modification C:\windows\SysWOW64\BZM.exe BEJCKTO.exe File created C:\windows\SysWOW64\JPGBE.exe 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe File created C:\windows\SysWOW64\BEZWD.exe.bat YQIN.exe File created C:\windows\SysWOW64\FUGW.exe BEZWD.exe File created C:\windows\SysWOW64\SIMPRXI.exe IKH.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat IKH.exe File created C:\windows\SysWOW64\XVHF.exe CICWNPB.exe File created C:\windows\SysWOW64\UOZP.exe QGKPUPA.exe File created C:\windows\SysWOW64\UMI.exe.bat WZJENKN.exe File opened for modification C:\windows\SysWOW64\SIMPRXI.exe IKH.exe File created C:\windows\SysWOW64\LGU.exe HDWTC.exe File created C:\windows\SysWOW64\OLTG.exe VSEVRC.exe File opened for modification C:\windows\SysWOW64\FOOXLKX.exe VQICW.exe File created C:\windows\SysWOW64\FUGW.exe.bat BEZWD.exe File created C:\windows\SysWOW64\VSEVRC.exe CPAZDMC.exe File created C:\windows\SysWOW64\ARUZXDJ.exe.bat QTO.exe File created C:\windows\SysWOW64\OLTG.exe.bat VSEVRC.exe File created C:\windows\SysWOW64\TXIVN.exe YCL.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe YCL.exe File created C:\windows\SysWOW64\EJEOUC.exe.bat ZGG.exe File opened for modification C:\windows\SysWOW64\AFVKJS.exe UEOW.exe File created C:\windows\SysWOW64\FOOXLKX.exe.bat VQICW.exe File opened for modification C:\windows\SysWOW64\YSV.exe UKPWOE.exe File opened for modification C:\windows\SysWOW64\LGU.exe HDWTC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\HZTPOCL.exe.bat XBNDZ.exe File created C:\windows\system\TOBOZ.exe TTXSUW.exe File opened for modification C:\windows\system\WOGCAS.exe BBCT.exe File created C:\windows\system\RUVF.exe.bat EJEOUC.exe File created C:\windows\system\LPG.exe.bat DCBN.exe File created C:\windows\ZGDIVLF.exe.bat FOOXLKX.exe File created C:\windows\system\BEJCKTO.exe.bat ZGDIVLF.exe File opened for modification C:\windows\system\HDWTC.exe SIMPRXI.exe File created C:\windows\system\BBCT.exe.bat HOXKGTV.exe File created C:\windows\system\DLHE.exe JSZT.exe File opened for modification C:\windows\system\GBNMXO.exe DLHE.exe File opened for modification C:\windows\system\FJB.exe KGS.exe File created C:\windows\LXVTU.exe.bat HHGTIM.exe File created C:\windows\WQERPDE.exe.bat MAZXIUV.exe File opened for modification C:\windows\CICWNPB.exe YSV.exe File created C:\windows\system\HDWTC.exe.bat SIMPRXI.exe File created C:\windows\system\WZJENKN.exe.bat GWZS.exe File created C:\windows\system\ANR.exe TXIVN.exe File created C:\windows\system\RUVF.exe EJEOUC.exe File created C:\windows\RDE.exe.bat IDCTCU.exe File opened for modification C:\windows\system\ZPYAS.exe AFVKJS.exe File created C:\windows\system\ZPYAS.exe.bat AFVKJS.exe File opened for modification C:\windows\system\PHVYWY.exe ARUZXDJ.exe File created C:\windows\system\XYJZTD.exe.bat LGU.exe File opened for modification C:\windows\XBNDZ.exe XYJZTD.exe File opened for modification C:\windows\SOH.exe JNFQVN.exe File created C:\windows\TEXWFC.exe.bat NEQ.exe File opened for modification C:\windows\QLUW.exe SNBBDZ.exe File created C:\windows\system\YDOFEYQ.exe.bat UMI.exe File opened for modification C:\windows\system\AQTO.exe YDOFEYQ.exe File created C:\windows\system\CPAZDMC.exe.bat BMWWY.exe File created C:\windows\UEOW.exe NONXTC.exe File created C:\windows\system\GBNMXO.exe DLHE.exe File opened for modification C:\windows\FLYUG.exe GBNMXO.exe File created C:\windows\SNACP.exe.bat JPGBE.exe File created C:\windows\system\GWZS.exe ILWCU.exe File opened for modification C:\windows\system\WZJENKN.exe GWZS.exe File created C:\windows\system\BBCT.exe HOXKGTV.exe File created C:\windows\system\ZGG.exe WQATHQ.exe File created C:\windows\DKKPK.exe LPG.exe File created C:\windows\system\BEJCKTO.exe ZGDIVLF.exe File created C:\windows\JPNXWFM.exe BZM.exe File opened for modification C:\windows\CMNPOSK.exe SOH.exe File created C:\windows\ILWCU.exe.bat QLUW.exe File created C:\windows\system\WOGCAS.exe.bat BBCT.exe File opened for modification C:\windows\DCBN.exe RUVF.exe File created C:\windows\system\LPG.exe DCBN.exe File created C:\windows\system\QSUZDR.exe.bat PPQV.exe File created C:\windows\system\STE.exe SQATTZ.exe File created C:\windows\system\MLT.exe.bat STE.exe File created C:\windows\system\XYJZTD.exe LGU.exe File created C:\windows\system\LCFBUET.exe.bat NOGA.exe File opened for modification C:\windows\system\NEQ.exe CMNPOSK.exe File opened for modification C:\windows\TEXWFC.exe NEQ.exe File created C:\windows\DCBN.exe RUVF.exe File created C:\windows\system\NSMDOR.exe DKKPK.exe File created C:\windows\SQATTZ.exe QSUZDR.exe File opened for modification C:\windows\LXVTU.exe HHGTIM.exe File opened for modification C:\windows\system\MAZXIUV.exe LXVTU.exe File created C:\windows\QGKPUPA.exe.bat AQJQN.exe File opened for modification C:\windows\SNBBDZ.exe USK.exe File opened for modification C:\windows\system\LPG.exe DCBN.exe File created C:\windows\JSZT.exe.bat JPNXWFM.exe File created C:\windows\system\MAZXIUV.exe LXVTU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5936 cmd.exe 5356 cmd.exe 3732 cmd.exe 4800 cmd.exe 6052 cmd.exe 2424 cmd.exe 1804 cmd.exe 2472 cmd.exe 2656 cmd.exe 2300 cmd.exe 5848 cmd.exe 3132 cmd.exe 4252 cmd.exe 4320 cmd.exe 4436 cmd.exe 5684 cmd.exe 248 cmd.exe 2412 cmd.exe 3412 cmd.exe 596 cmd.exe 2808 cmd.exe 4628 cmd.exe 4292 cmd.exe 3180 cmd.exe 3192 cmd.exe 1944 cmd.exe 428 cmd.exe 5352 cmd.exe 5416 cmd.exe 5836 cmd.exe 3340 cmd.exe 2888 cmd.exe 4156 cmd.exe 4512 cmd.exe 5068 cmd.exe 2628 cmd.exe 4260 cmd.exe 5300 cmd.exe 4676 cmd.exe 4336 cmd.exe 4384 cmd.exe 4240 cmd.exe 628 cmd.exe 3168 cmd.exe 4840 cmd.exe 2908 cmd.exe 3932 cmd.exe 4536 cmd.exe 5420 cmd.exe 3720 cmd.exe 4532 cmd.exe 1476 cmd.exe 504 cmd.exe 3736 cmd.exe 676 cmd.exe 3128 cmd.exe 2556 cmd.exe 5448 cmd.exe 5764 cmd.exe 2600 cmd.exe 5736 cmd.exe 1756 cmd.exe 3288 cmd.exe 4720 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4592 3388 WerFault.exe 87 5388 1680 WerFault.exe 93 3672 5436 WerFault.exe 99 5696 1856 WerFault.exe 104 596 2872 WerFault.exe 109 5860 2000 WerFault.exe 114 1340 4444 WerFault.exe 119 3404 2364 WerFault.exe 124 3932 2940 WerFault.exe 129 5992 1776 WerFault.exe 134 1232 1432 WerFault.exe 138 2216 4740 WerFault.exe 144 3192 4544 WerFault.exe 149 3568 2392 WerFault.exe 154 1184 5864 WerFault.exe 159 1228 960 WerFault.exe 164 976 3892 WerFault.exe 169 1340 5868 WerFault.exe 174 4976 5020 WerFault.exe 179 5224 5404 WerFault.exe 184 5428 1728 WerFault.exe 189 5596 3708 WerFault.exe 194 5748 2428 WerFault.exe 199 3192 3448 WerFault.exe 204 5684 1704 WerFault.exe 209 5164 4824 WerFault.exe 214 4640 4460 WerFault.exe 219 4184 4732 WerFault.exe 224 2808 4296 WerFault.exe 229 2240 4340 WerFault.exe 234 1188 4976 WerFault.exe 239 5352 5224 WerFault.exe 244 5272 5376 WerFault.exe 249 756 5596 WerFault.exe 254 260 4592 WerFault.exe 259 5028 1748 WerFault.exe 264 4772 1768 WerFault.exe 269 1012 2956 WerFault.exe 275 1896 4788 WerFault.exe 280 1840 3204 WerFault.exe 285 3820 3636 WerFault.exe 290 4840 1796 WerFault.exe 295 5748 1548 WerFault.exe 300 3192 2484 WerFault.exe 305 252 1456 WerFault.exe 310 2052 3644 WerFault.exe 315 5732 5572 WerFault.exe 320 3372 1420 WerFault.exe 325 2904 4932 WerFault.exe 330 5176 4808 WerFault.exe 335 3380 3700 WerFault.exe 340 3308 3592 WerFault.exe 345 824 4844 WerFault.exe 350 3196 2536 WerFault.exe 355 5184 3140 WerFault.exe 360 4772 1160 WerFault.exe 365 1500 1128 WerFault.exe 370 5100 5780 WerFault.exe 375 1096 3760 WerFault.exe 380 4760 4588 WerFault.exe 385 2072 5548 WerFault.exe 390 3128 904 WerFault.exe 395 2532 3016 WerFault.exe 400 4436 5392 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGDIVLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPNXWFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZTPOCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOOXLKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARUZXDJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAZXIUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNBBDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CICWNPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZJENKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJEOUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQJQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQATHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFVKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLYUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPGBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCFBUET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTXSUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSEVRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGKPUPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHYQKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOBOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILWCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQICW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3388 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe 3388 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe 1680 JPGBE.exe 1680 JPGBE.exe 5436 SNACP.exe 5436 SNACP.exe 1856 QXDS.exe 1856 QXDS.exe 2872 SVR.exe 2872 SVR.exe 2000 YQIN.exe 2000 YQIN.exe 4444 BEZWD.exe 4444 BEZWD.exe 2364 FUGW.exe 2364 FUGW.exe 2940 UKPWOE.exe 2940 UKPWOE.exe 1776 YSV.exe 1776 YSV.exe 1432 CICWNPB.exe 1432 CICWNPB.exe 4740 XVHF.exe 4740 XVHF.exe 4544 DQGOU.exe 4544 DQGOU.exe 2392 QTO.exe 2392 QTO.exe 5864 ARUZXDJ.exe 5864 ARUZXDJ.exe 960 PHVYWY.exe 960 PHVYWY.exe 3892 IKH.exe 3892 IKH.exe 5868 SIMPRXI.exe 5868 SIMPRXI.exe 5020 HDWTC.exe 5020 HDWTC.exe 5404 LGU.exe 5404 LGU.exe 1728 XYJZTD.exe 1728 XYJZTD.exe 3708 XBNDZ.exe 3708 XBNDZ.exe 2428 HZTPOCL.exe 2428 HZTPOCL.exe 3448 RIVCSH.exe 3448 RIVCSH.exe 1704 WICQBB.exe 1704 WICQBB.exe 4824 AQJQN.exe 4824 AQJQN.exe 4460 QGKPUPA.exe 4460 QGKPUPA.exe 4732 UOZP.exe 4732 UOZP.exe 4296 NOGA.exe 4296 NOGA.exe 4340 LCFBUET.exe 4340 LCFBUET.exe 4976 QHYQKZ.exe 4976 QHYQKZ.exe 5224 FXZQ.exe 5224 FXZQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3388 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe 3388 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe 1680 JPGBE.exe 1680 JPGBE.exe 5436 SNACP.exe 5436 SNACP.exe 1856 QXDS.exe 1856 QXDS.exe 2872 SVR.exe 2872 SVR.exe 2000 YQIN.exe 2000 YQIN.exe 4444 BEZWD.exe 4444 BEZWD.exe 2364 FUGW.exe 2364 FUGW.exe 2940 UKPWOE.exe 2940 UKPWOE.exe 1776 YSV.exe 1776 YSV.exe 1432 CICWNPB.exe 1432 CICWNPB.exe 4740 XVHF.exe 4740 XVHF.exe 4544 DQGOU.exe 4544 DQGOU.exe 2392 QTO.exe 2392 QTO.exe 5864 ARUZXDJ.exe 5864 ARUZXDJ.exe 960 PHVYWY.exe 960 PHVYWY.exe 3892 IKH.exe 3892 IKH.exe 5868 SIMPRXI.exe 5868 SIMPRXI.exe 5020 HDWTC.exe 5020 HDWTC.exe 5404 LGU.exe 5404 LGU.exe 1728 XYJZTD.exe 1728 XYJZTD.exe 3708 XBNDZ.exe 3708 XBNDZ.exe 2428 HZTPOCL.exe 2428 HZTPOCL.exe 3448 RIVCSH.exe 3448 RIVCSH.exe 1704 WICQBB.exe 1704 WICQBB.exe 4824 AQJQN.exe 4824 AQJQN.exe 4460 QGKPUPA.exe 4460 QGKPUPA.exe 4732 UOZP.exe 4732 UOZP.exe 4296 NOGA.exe 4296 NOGA.exe 4340 LCFBUET.exe 4340 LCFBUET.exe 4976 QHYQKZ.exe 4976 QHYQKZ.exe 5224 FXZQ.exe 5224 FXZQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3388 wrote to memory of 4948 3388 2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe 89 PID 4948 wrote to memory of 1680 4948 cmd.exe 93 PID 1680 wrote to memory of 5936 1680 JPGBE.exe 95 PID 5936 wrote to memory of 5436 5936 cmd.exe 99 PID 5436 wrote to memory of 5032 5436 SNACP.exe 100 PID 5032 wrote to memory of 1856 5032 cmd.exe 104 PID 1856 wrote to memory of 2584 1856 QXDS.exe 105 PID 2584 wrote to memory of 2872 2584 cmd.exe 109 PID 2872 wrote to memory of 4240 2872 SVR.exe 110 PID 4240 wrote to memory of 2000 4240 cmd.exe 114 PID 2000 wrote to memory of 5504 2000 YQIN.exe 115 PID 5504 wrote to memory of 4444 5504 cmd.exe 119 PID 4444 wrote to memory of 3412 4444 BEZWD.exe 120 PID 3412 wrote to memory of 2364 3412 cmd.exe 124 PID 2364 wrote to memory of 3120 2364 FUGW.exe 125 PID 3120 wrote to memory of 2940 3120 cmd.exe 129 PID 2940 wrote to memory of 4512 2940 UKPWOE.exe 130 PID 4512 wrote to memory of 1776 4512 cmd.exe 134 PID 1776 wrote to memory of 6088 1776 YSV.exe 135 PID 6088 wrote to memory of 1432 6088 cmd.exe 138 PID 1432 wrote to memory of 5260 1432 CICWNPB.exe 140 PID 5260 wrote to memory of 4740 5260 cmd.exe 144 PID 4740 wrote to memory of 1844 4740 XVHF.exe 145 PID 1844 wrote to memory of 4544 1844 cmd.exe 149 PID 4544 wrote to memory of 1116 4544 DQGOU.exe 150 PID 1116 wrote to memory of 2392 1116 cmd.exe 154 PID 2392 wrote to memory of 5068 2392 QTO.exe 155 PID 5068 wrote to memory of 5864 5068 cmd.exe 159 PID 5864 wrote to memory of 1176 5864 ARUZXDJ.exe 160 PID 1176 wrote to memory of 960 1176 cmd.exe 164 PID 960 wrote to memory of 700 960 PHVYWY.exe 165 PID 700 wrote to memory of 3892 700 cmd.exe 169 PID 3892 wrote to memory of 4536 3892 IKH.exe 170 PID 4536 wrote to memory of 5868 4536 cmd.exe 174 PID 5868 wrote to memory of 4384 5868 SIMPRXI.exe 175 PID 4384 wrote to memory of 5020 4384 cmd.exe 179 PID 5020 wrote to memory of 2248 5020 HDWTC.exe 180 PID 2248 wrote to memory of 5404 2248 cmd.exe 184 PID 5404 wrote to memory of 676 5404 LGU.exe 185 PID 676 wrote to memory of 1728 676 cmd.exe 189 PID 1728 wrote to memory of 2436 1728 XYJZTD.exe 190 PID 2436 wrote to memory of 3708 2436 cmd.exe 194 PID 3708 wrote to memory of 5024 3708 XBNDZ.exe 195 PID 5024 wrote to memory of 2428 5024 cmd.exe 199 PID 2428 wrote to memory of 5584 2428 HZTPOCL.exe 200 PID 5584 wrote to memory of 3448 5584 cmd.exe 204 PID 3448 wrote to memory of 3316 3448 RIVCSH.exe 205 PID 3316 wrote to memory of 1704 3316 cmd.exe 209 PID 1704 wrote to memory of 6104 1704 WICQBB.exe 210 PID 6104 wrote to memory of 4824 6104 cmd.exe 214 PID 4824 wrote to memory of 5124 4824 AQJQN.exe 215 PID 5124 wrote to memory of 4460 5124 cmd.exe 219 PID 4460 wrote to memory of 2812 4460 QGKPUPA.exe 220 PID 2812 wrote to memory of 4732 2812 cmd.exe 224 PID 4732 wrote to memory of 4432 4732 UOZP.exe 225 PID 4432 wrote to memory of 4296 4432 cmd.exe 229 PID 4296 wrote to memory of 2552 4296 NOGA.exe 230 PID 2552 wrote to memory of 4340 2552 cmd.exe 234 PID 4340 wrote to memory of 1920 4340 LCFBUET.exe 235 PID 1920 wrote to memory of 4976 1920 cmd.exe 239 PID 4976 wrote to memory of 1900 4976 QHYQKZ.exe 240 PID 1900 wrote to memory of 5224 1900 cmd.exe 244 PID 5224 wrote to memory of 5356 5224 FXZQ.exe 245 PID 5356 wrote to memory of 5376 5356 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_68782efa24e5cd62db90042edc3af675_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPGBE.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\SysWOW64\JPGBE.exeC:\windows\system32\JPGBE.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNACP.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\SNACP.exeC:\windows\SNACP.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXDS.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\SysWOW64\QXDS.exeC:\windows\system32\QXDS.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVR.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\SVR.exeC:\windows\SVR.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQIN.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\YQIN.exeC:\windows\YQIN.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEZWD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\windows\SysWOW64\BEZWD.exeC:\windows\system32\BEZWD.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UKPWOE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\system\UKPWOE.exeC:\windows\system\UKPWOE.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSV.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\SysWOW64\YSV.exeC:\windows\system32\YSV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CICWNPB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\CICWNPB.exeC:\windows\CICWNPB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVHF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\SysWOW64\XVHF.exeC:\windows\system32\XVHF.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQGOU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\DQGOU.exeC:\windows\DQGOU.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTO.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\QTO.exeC:\windows\QTO.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARUZXDJ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\SysWOW64\ARUZXDJ.exeC:\windows\system32\ARUZXDJ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHVYWY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\system\PHVYWY.exeC:\windows\system\PHVYWY.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKH.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\IKH.exeC:\windows\system\IKH.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIMPRXI.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\SIMPRXI.exeC:\windows\system32\SIMPRXI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HDWTC.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\system\HDWTC.exeC:\windows\system\HDWTC.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XYJZTD.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:676 -
C:\windows\system\XYJZTD.exeC:\windows\system\XYJZTD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBNDZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\XBNDZ.exeC:\windows\XBNDZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZTPOCL.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\system\HZTPOCL.exeC:\windows\system\HZTPOCL.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIVCSH.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\windows\system\RIVCSH.exeC:\windows\system\RIVCSH.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\WICQBB.exeC:\windows\WICQBB.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQJQN.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\AQJQN.exeC:\windows\AQJQN.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGKPUPA.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\QGKPUPA.exeC:\windows\QGKPUPA.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOZP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\SysWOW64\UOZP.exeC:\windows\system32\UOZP.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOGA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\NOGA.exeC:\windows\NOGA.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCFBUET.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\system\LCFBUET.exeC:\windows\system\LCFBUET.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHYQKZ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\SysWOW64\QHYQKZ.exeC:\windows\system32\QHYQKZ.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXZQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\windows\system\FXZQ.exeC:\windows\system\FXZQ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "66⤵PID:2256
-
C:\windows\SOH.exeC:\windows\SOH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "68⤵PID:4148
-
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEQ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:628 -
C:\windows\system\NEQ.exeC:\windows\system\NEQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEXWFC.exe.bat" "72⤵PID:1180
-
C:\windows\TEXWFC.exeC:\windows\TEXWFC.exe73⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2628 -
C:\windows\system\XUE.exeC:\windows\system\XUE.exe75⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5416 -
C:\windows\system\USK.exeC:\windows\system\USK.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3168 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLUW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:6064 -
C:\windows\QLUW.exeC:\windows\QLUW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWZS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3976 -
C:\windows\system\GWZS.exeC:\windows\system\GWZS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "86⤵PID:5428
-
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "88⤵PID:2216
-
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDOFEYQ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3132 -
C:\windows\system\YDOFEYQ.exeC:\windows\system\YDOFEYQ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQTO.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3732 -
C:\windows\system\AQTO.exeC:\windows\system\AQTO.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTXSUW.exe.bat" "94⤵PID:3780
-
C:\windows\SysWOW64\TTXSUW.exeC:\windows\system32\TTXSUW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOBOZ.exe.bat" "96⤵PID:4476
-
C:\windows\system\TOBOZ.exeC:\windows\system\TOBOZ.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MRNRNBS.exe.bat" "98⤵PID:4448
-
C:\windows\MRNRNBS.exeC:\windows\MRNRNBS.exe99⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWWY.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4704 -
C:\windows\BMWWY.exeC:\windows\BMWWY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPAZDMC.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3928 -
C:\windows\system\CPAZDMC.exeC:\windows\system\CPAZDMC.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSEVRC.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4840 -
C:\windows\SysWOW64\VSEVRC.exeC:\windows\system32\VSEVRC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLTG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5420 -
C:\windows\SysWOW64\OLTG.exeC:\windows\system32\OLTG.exe107⤵
- Executes dropped EXE
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "108⤵PID:3972
-
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBCT.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4800 -
C:\windows\system\BBCT.exeC:\windows\system\BBCT.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "112⤵PID:4112
-
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe113⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "114⤵
- Executes a command shell one-liner
PID:596 -
C:\windows\YCL.exeC:\windows\YCL.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "116⤵PID:2168
-
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2600 -
C:\windows\system\ANR.exeC:\windows\system\ANR.exe119⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQATHQ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2472 -
C:\windows\system\WQATHQ.exeC:\windows\system\WQATHQ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-